Hostile 93% Download

8ffb62e9f2dd5f8644fe8a4ddb5e0b26dfde018b78c06561edec11afdbb7ae6e

UPX-packed MIPS botnet malware

Hostile packed IoT shell-command botSectionless high-entropy MIPS ELF with sparse recovered code
SHA-2568ffb62e9f2dd5f8644fe8a4ddb5e0b26dfde018b78c06561edec11afdbb7ae6e

Evidence

ELF32 header omits section table 0x0–0x180
0x07f454c46010201000000000000000000.ELF............
0x1000020008000000010041fb6800000034.........A.h...4
0x2000000000000010070034002000020028.........4. ...(
0x3000000000000000010000000000400000.............@..
0x4000400000000205b2000205b200000005.@..............
0x5000010000000000010000000000430000.............C..
0x6000430000000000000008ac1800000006.C..............
0x70000100000c2ad42a555058210a580d89.....*.*UPX!.X..
0x8000000000000000000000000000000094................
0x900000005c020000007cf724ff7f454c46...\....|.$..ELF
⋯15 more rows
Embedded CNC control marker 0x19487–0x19777
⋯7 more rows
0x194f740af1d796d6e74686fbf082cd8f76707@..ymntho..,..g.
0x195075b636e635d072f080084f303bb010c25[cnc]./........%
0x19517356875d6b6618b31eae674d52d4c04735hu..a.1..t.-L.s
⋯18 more rows
0x19647aa4953372bbe227feedf556e53f11385.IS7+."...UnS...
0x196576d76202d66bfc2626f74fffedbd37632mv -f..bot....v2
0x196674b6d03313a76343a4a426cd825303258Km.1:v4:JBl.%02X
0x19677d21bd863df64256303132fb775c108fb...c.d%c../.u...
0x19687a12f0775da87f416364e096e5803176d./.u....6N.nX..m
0x196976b8a5068170b27466608d6be6fed2f2dk.Ph..'Ff...o./-
0x196a71672632e64046c22f1bbbad9b2130eb3.rc.d.l"........
0x196b72b477869fe8ed0be74370a5468260a11+Gxi....t7.Th&..
⋯12 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.